feat(secrets-mcp): 审计页、audit_log user_id、OAuth 登录与仪表盘 footer

- audit_log 增加 user_id；业务写审计透传 user_id
- Web /audit 与侧边栏；Dashboard 版本 footer 贴底（margin-top: auto）
- 停止 API Key 鉴权成功写入登录审计
- 文档、CI、release-check 配套更新

Made-with: Cursor

crates/secrets-core/src/service/add.rs

@@ -346,6 +346,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->
 
     crate::audit::log_tx(
         &mut tx,
+        params.user_id,
         "add",
         params.namespace,
         params.kind,

crates/secrets-core/src/service/audit_log.rs

@@ -0,0 +1,23 @@
+use anyhow::Result;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::models::AuditLogEntry;
+
+pub async fn list_for_user(pool: &PgPool, user_id: Uuid, limit: i64) -> Result<Vec<AuditLogEntry>> {
+    let limit = limit.clamp(1, 200);
+
+    let rows = sqlx::query_as(
+        "SELECT id, user_id, action, namespace, kind, name, detail, actor, created_at \
+         FROM audit_log \
+         WHERE user_id = $1 OR (user_id IS NULL AND detail->>'user_id' = $1::text) \
+         ORDER BY created_at DESC, id DESC \
+         LIMIT $2",
+    )
+    .bind(user_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await?;
+
+    Ok(rows)
+}

crates/secrets-core/src/service/delete.rs

@@ -137,7 +137,7 @@ async fn delete_one(
     };
 
     snapshot_and_delete(&mut tx, namespace, kind, name, &row, user_id).await?;
-    crate::audit::log_tx(&mut tx, "delete", namespace, kind, name, json!({})).await;
+    crate::audit::log_tx(&mut tx, user_id, "delete", namespace, kind, name, json!({})).await;
     tx.commit().await?;
 
     Ok(DeleteResult {
@@ -240,6 +240,7 @@ async fn delete_bulk(
         .await?;
         crate::audit::log_tx(
             &mut tx,
+            user_id,
             "delete",
             namespace,
             &row.kind,

crates/secrets-core/src/service/mod.rs

@@ -1,5 +1,6 @@
 pub mod add;
 pub mod api_key;
+pub mod audit_log;
 pub mod delete;
 pub mod env_map;
 pub mod export;

crates/secrets-core/src/service/rollback.rs

@@ -274,6 +274,7 @@ pub async fn run(
 
     crate::audit::log_tx(
         &mut tx,
+        user_id,
         "rollback",
         namespace,
         kind,

crates/secrets-core/src/service/update.rs

@@ -241,6 +241,7 @@ pub async fn run(
 
     crate::audit::log_tx(
         &mut tx,
+        params.user_id,
         "update",
         params.namespace,
         params.kind,